US7539719B2

US7539719B2 - Method and apparatus for performing multiplication in finite field GF(2n)

Info

Publication number: US7539719B2
Application number: US10/965,907
Authority: US
Inventors: Weon-Il Jin; Mi-Suk Huh; Kyung-Hee Lee; Bum-Jin Im
Original assignee: Samsung Electronics Co Ltd
Current assignee: Samsung Electronics Co Ltd
Priority date: 2003-10-16
Filing date: 2004-10-18
Publication date: 2009-05-26
Also published as: US20050086278A1; KR20050036451A; KR100552694B1

Abstract

A method of obtaining C=(c₀, . . . , c_n−1) of a product of two elements A and B of a finite field GF(2ⁿ). The method includes permuting the last d coefficients (a_n−1, . . . , a_n−d) of a multiplier A with predetermined variables (s_n−1, . . . , s_n−d); operating C:C=⊕(b_i+j●A) for (I+j)^thcoefficient of a multiplicand B to update coefficients of C, where i and j are integers, and A:=(s_{, . . . ,α} _x−2)⊕(0,x_n−1−j●f₁, . . . ,s_x−1−j●f_x−d,0, . . . ,0) repeatedly for j=0 to (d−1) to update coefficients of A, where ⊕ represents an XOR operation and ● represents an AND operation; and repeatedly performing the permuting and operating by increasing i from 0 to (n−1) by d.

Description

BACKGROUND OF THE INVENTION

This application claims the priority of Korean Patent Application No. 2003-72140, filed on Oct. 16, 2003, in the Korean Intellectual Property Office, the disclosure of which is incorporated herein in its entirety by reference.

FIELD OF THE INVENTION

The present invention relates to a method and apparatus for performing multiplication in a finite field.

DESCRIPTION OF THE RELATED ART

A finite field GF(2ⁿ) is a number system containing 2ⁿelements. Based on the fact that each element of the finite field GF(2ⁿ) can be represented by n bits, practical applications of the finite field can be accomplished. Practical applications, such as implementation of an error correction code or elliptic curve cryptosystem in hardware, frequently perform calculations in GF(2ⁿ). An apparatus for encoding/decoding Reed-Solomon codes performs calculation in GF(2ⁿ), and an encryption/decryption apparatus of an elliptic curve cryptosystem performs calculation in GF(2ⁿ) where “n” is a large value.

The addition and multiplication rules of GF(2ⁿ), which contains only

binary numbers

0 and 1, are defined by Equation (1).
0+0=1+1=0
0+1=1+0=1
0=0×1=0
1×1=1 (1)

Here, addition is a bitwise exclusive OR (referred to as XOR hereinafter) operation, and multiplication is a bitwise AND (referred to as AND hereinafter) operation.

Since the finite field GF(2ⁿ) (n>1) is a number system containing 2ⁿelements, addition and multiplication correspond to arithmetic modulo for an irreducible n^th-degree polynomial having coefficients in GF(2). The irreducible polynomial of degree n is referred to as a defining polynomial of the finite field. When a root of the defining polynomial is α, an element of the finite field has a standard representation given by Equation (2).
α₀+α₁α+α₂α²+ . . . +α_n−1αⁿ⁻¹=(α₀,α₁,α₂, . . . ,α_n−1), α_i ∈GF(2) (2)

Multiplication of two elements in GF(2ⁿ) is given by polynomial multiplication of α and then a modulo operation by the defining polynomial. Addition of two elements in GF(2ⁿ) is performed by polynomial addition of α.

Multipliers, which perform multiplication in the finite field, can include a serial multiplier, a parallel multiplier, and a systolic multiplier. The serial multiplier has low area complexity, and the parallel multiplier performs multiplication using only a gate delay without latency. Accordingly, the parallel multiplier has high area complexity compared to the serial multiplier, but can reduce time complexity considerably. The systolic multiplier is designed to increase throughput, and thus, has relatively high area and time complexity.

For the serial multiplier among the multipliers, there is a demand for a method and apparatus for performing multiplication in a finite field by means of the serial multiplier that can reduce computational time and minimize the increase in area complexity.

SUMMARY OF THE INVENTION

The present invention provides a method and apparatus for performing multiplication through parallel processing by d bit unit when coefficients of the last d terms in a defining polynomial are assumed to be “0”.

According to an aspect of the present invention, there is provided a method of obtaining C=(c₀, . . . , c_n−1) of a product of two elements A and B of a finite field GF(2ⁿ) when a defining polynomial f(x) of degree n in the finite field GF(2ⁿ) is defined by
f(x)=x ⁿ +h(x)=x ⁿ+(f _n−1 x ⁿ⁻¹ + . . . +f ₁ x+f ₀), f _i∈{0,1},
where f_n−1= . . . =f_n−d+1=0, d≧2 is an integer, α is a root of the defining polynomial, A and B of the finite field are expressed as
A=α ₀+α₁α+α₂α²+ . . . +α_n−1αⁿ⁻¹=(α₀,α₁,α₂, . . . ,α_n−1),
B=b ₀ +b ₁ α+b ₂α² + . . . +b _n−1αⁿ⁻¹=(b ₀ ,b ₁ ,b ₂ , . . . ,b _n−1)
with respect to the root α, and C of the product of A and B can be rewritten as C=A×B mod f(α), the method comprising: permuting the last d coefficients (a_n−1, . . . , a_n−d) of a multiplier A with predetermined variables (s_n−1, . . . , s_n−d); operating C:=C⊕(b_i+j●A) for (i+j)^thcoefficient of a multiplicand B to update coefficients of C, where i and j are integers, and A:=(s_n−1−j,α₀, . . . ,α_n−2)⊕(0,s_n−1−j●f₁, . . . ,s_n−1−j●f_n−d,0, . . . ,0) repeatedly for j=0 to (d−1) to update coefficients of A, where ⊕ represents an XOR operation and ● represents an AND operation; and repeatedly performing the permuting and operating by increasing i from 0 to (n−1) by d.

According to another aspect of the present invention, there is provided an apparatus for obtaining C=(c₀, . . . , c_n−1), of a product of two elements A and B of a finite field GF(2ⁿ) when a defining polynomial f(x) of degree n in GF(2ⁿ) is defined by
f(x)=x ⁿ +h(x)=x ⁿ+(f _n−1 x ⁿ⁻¹ + . . . +f ₁ x+f ₀), f _i∈{0,1},
where f_n−1= . . . =f_n−d+1=0, d≧2, d is an integer, α is a root of the defining polynomial, A and B of the finite field are expressed as
A=α ₀+α₁α+α₂α²+ . . . +α_n−1αⁿ⁻¹=(α₀,α₁,α₂, . . . ,α_n−1),
B=b ₀ +b ₁ α+b ₂α² + . . . +b _n−1αⁿ⁻¹=(b ₀ ,b ₁ ,b ₂ , . . . ,b _n−1)
with respect to the root α, and C of the product of A and B can be rewritten as C=A×B mod f(α), the apparatus comprising: a multiplier storage unit, which stores coefficients of a multiplier A; a multiplicand storage unit, which stores coefficients of a multiplicand B; a product storage unit, which stores C of the product of A and B; a multiplication unit, which performs operations of the following Equation
C:=C⊕(b _i+j ●A),
repeatedly, for j=0 to (d−1), where i and j are integers, ⊕ represents an XOR operation, and ● represents an AND operation, repeatedly performs the above steps by increasing the variable i from 0 to (n−1) by d to obtain updated coefficients of C, and outputs the updated coefficients of C to the product storage unit; and a multiplier updating unit, which performs operations of the following Equation
A:=(s _n−1−j,α₀, . . . ,α_n−2)⊕(0,s _n−1−j ●f ₁ , . . . ,s _n−1−j ●f _n−d,0, . . . ,0)
to update the coefficients of A, where i and j are integers, ⊕ represents an XOR operation, and ● represents an AND operation, and outputs the updated coefficients of A to the multiplier storage unit.

According to still another aspect of the present invention, there is provided a method of obtaining C=(c₀, . . . , c_n−1), of the product of two elements A and B of a finite field GF(2ⁿ) when a defining polynomial f(x) of degree n in GF(2ⁿ) is defined as
f(x)=x ⁿ +h(x)=x ⁿ+(f _n−1 x ⁿ⁻¹ + . . . +f ₁ x+f ₀), f _i∈{0,1},
where f_n−1= . . . =f_n−d+1=0, d≧2, d is an integer, α is a root of the defining polynomial, A and B of the finite field have a standard representation with respect to
A=α ₀+α₁α+α₂α²+ . . . +α_n−1αⁿ⁻¹=(α₀,α₁,α₂, . . . ,α_n−1),
the root α as shown in
B=b ₀ +b ₁ α+b ₂α² + . . . +b _n−1αⁿ⁻¹=(b ₀ ,b ₁ ,b ₂ , . . . ,b _n−1),
A′, a dual representation of A, is expressed as
A′=(α₀′,α₁′,α₂′, . . . ,α_n−1′),
and C can be written as C=A×B mod f(α), the method comprising: converting A into A′; operating of the following formulae
s _j:=α_j′⊕(f ₁●α_j+1′)⊕ . . . ⊕(f _n−d●α_n−d+j′)
c _i+j′:=(b ₀●α_j′)⊕ . . . ⊕(b _n−1−j●α_n−1′)⊕(b _n−j ●s ₀)⊕ . . . ⊕(b _n−1 ●s _j−1)
repeatedly for i, j=0 to d−1 to update coefficients of C′, which is a dual representation of C, where i and j are integers, c_i+j, is a dual representation of c_i+j,; shifting A′ left d times to update A′; updating the last d coefficients of A′ with s_j; repeatedly performing the operating, shifting, and updating by increasing the variable i from 0 to (n−1) by d to obtain updated coefficients of C′; and performing basis conversion on the updated C′.

According to yet another aspect of the present invention, there is provided an apparatus for obtaining C=(c₀, . . . , c_n−1), of a product of two elements A and B of a finite field GF(2ⁿ) when a defining polynomial f(x) of degree n in GF(2ⁿ) is defined as
f(x)=x ⁿ +h(x)=x ⁿ+(f _n−1 x ⁿ⁻¹ + . . . +f ₁ x+f ₀), f _i∈{0,1},
where f_n−1= . . . =f_n−d+1=0, d≧2, d is an integer, α is a root of the defining polynomial, the two elements A and B of the finite field have a standard representation with respect to the root α as shown in
A=α ₀+α₁α+α₂α²+ . . . +α_n−1αⁿ⁻¹=(α₀,α₁,α₂, . . . ,α_n−1),
B=b ₀ +b ₁ α+b ₂α² + . . . +b _n−1αⁿ⁻¹=(b ₀ ,b ₁ ,b ₂ , . . . ,b _n−1),
A′, a dual representation of A, is expressed as
A′=(α₀′,α₁′,α₂′, . . . ,α_n−1′),
and C of A and B is rewritten as C=A×B mod f(α), the apparatus comprising: a basis converting unit, which converts the standard representation into a dual representation, or converts the dual representation into the standard representation; a multiplicand storage unit, which stores coefficients of a multiplicand B; a multiplier storage unit, which stores coefficients of A′ obtained by converting basis, of a multiplier A by means of the basis converting unit; a multiplier updating unit, which updates the coefficients of A′ according to a predetermined Equation and outputs the updated coefficients to the multiplier storage unit; and an operation unit, which includes a plurality of multipliers multiplying each m^thcoefficient from the multiplicand storage unit by each (m+j)^thcoefficient from the multiplier storage unit where j varies from 0 to (d−1) and multiply the last j coefficients from the multiplicand storage unit by a part of outputs from the multiplier updating unit, and a plurality of logic operation members fort performing XOR operations on only outputs containing the (m+j)^thcoefficients from the plurality of multipliers and output the last d c_i's, wherein after C′ is obtained by the operation unit, the basis converting unit converting basis of C′ to obtain C.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other features and advantages of the present invention will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings in which:

FIG. 1 illustrates a configuration of an apparatus for performing multiplication using a standard basis according to a first exemplary embodiment of the present invention;

FIG. 2 illustrates a configuration of an apparatus for performing multiplication using a dual basis according to a second exemplary embodiment of the present invention; and

FIGS. 3 and 4 illustrate embodiments of basis converting means for multiplication based on a dual basis.

DETAILED DESCRIPTION OF THE INVENTION

The present invention will now be described more fully with reference to the accompanying drawings, in which exemplary embodiments of the invention are shown.

A defining polynomial f(x) of a finite field GF(2ⁿ) is represented by Equation 3.
f(x)=x ⁿ +h(x)=x ⁿ+(f _n−1 x ⁿ⁻¹ + . . . +f ₁ x+f ₀), f _i∈{0,1} (3)

If α is a root of the defining polynomial, h(a) is defined by Equation 4.
h(α)=(f ₀ ,f ₁ ,f ₂ , . . . ,f _n−1) (4)

Assume that ⊕ represents a bitwise XOR operation and ● represents a bitwise AND operation. An operation ● between a bit and a vector is defined by Equation 5.
α●(c ₀ , . . . , c _n−1)=(α●c ₀ , . . . , α●c _n−1), where α, c _i={0,1} (5)

Shift operations designated by >> and << are defined as follows. (α₀, . . . ,α_n−1)>>1 means that each coefficient is shifted right once as shown in Equation 6.
For [i=n−1 to 1]
α_i:=α_i−1
α₀:=0 (6)

(α₀, . . . ,α_n−1)<<1 means that each coefficient is shifted left once as shown in Equation 7.
For [i=0 to n−2]
α_i:=α_i+1
α_n−1:=0 (7)

Two bases, i.e., a standard basis and a dual basis, are used for multiplication of two elements of the finite field according to an embodiment of the present invention.

First, multiplication using the standard basis will now be explained.

When the standard basis is used, two elements A and B of GF(2ⁿ) may be defined by Equation 8.
A=α ₀+α₁α+α₂α²+ . . . +α_n−1αⁿ⁻¹=(α₀,α₁,α₂, . . . ,α_n−1),
B=b ₀ +b ₁ α+b ₃α² + . . . +b _n−1αⁿ⁻¹=(b ₀ ,b ₁ ,b ₂ , . . . ,b _n−1) (8)

A product C of A and B is defined by Equation 9.
C=A×B mod f(α) (9)

Here, × represents polynomial multiplication.

Equation 9 can be expanded as a code expression in Equation 10.
C:=(0, . . . , 0)
For [i=0 to n−1]
C:=C⊕(b _i ●A)
A:=(A>>1)⊕(α_n−1 ●h(α))
Rename coefficients of the element A as α₀, . . . ,α_n−1 (10)

Multiplication according to Equation 10 will now be explained in detail. An i^thcoefficient of a multiplicand B is multiplied by each coefficient of a multiplier A, and an exclusive OR (XOR) operation is performed on the results of the multiplication and previous coefficients of the product C, thereby updating the respective coefficients of the product C. Also, a coefficient of a term with the highest power of A is multiplied by each coefficient of terms other than the term with the highest power in the defining polynomial of the finite field. The multiplication results are XORed with once rightly shifted coefficients of A, thereby updating the respective coefficients of the A. Final C is obtained by repeating the above-described process n times.

Changes of the multiplier A within the for loop in the multiplication algorithm of Equation 10 will now be explained. When i=k, it is assumed that
f _n−1 = . . . =f _x−d+1=0_in b _k •A, and s _n−1:=α_n−1 , . . . ,s _n−d:=α_n−d(d≧2).
When i=k+1, A may be defined by Equation 11, based on Equation 10.
A=(s _n−1,α₀, . . . ,α_n−2)⊕(0,s _n−1 ●f _n−d,0, . . . ,0) (11)

When i=k+2, A may be expressed by Equation 12, based on Equation 10.
A=(s _n−2 ,s _n−1,α₀, . . . ,α_n−3)⊕(0,0,s _n−1 ●f ₁ , . . . ,s _n−1 ●f _n−d,0, . . . ,0)⊕(0,s _n−2 ●f ₁ , . . . ,s _n−2 ●f _n−d,0, . . . ,0) (12)

In the same manner, when i=k+d, A may be defined by Equation 13, based on Equation 10.
A=(s _n−d , . . . ,s _n−1,α₀, . . . ,α_n−d−1)⊕(0, . . . ,0,s _n−1 ●f ₁ , . . . ,s _n−1 ●f _n−d)⊕0 . . . ⊕(0,s _n−d ●f ₁ , . . . ,s _n−d ●f _n−d,0, . . . ,0) (13)

Accordingly, when i=k+d, d-bit parallel processing can be done by assumption. Further, if d is small enough, it satisfies most practical cases, that is, parameters of the elliptic curve cryptosystem according to SEC and ANSI X9.62 standards, thereby not violating practicability.

Multiplication using the standard basis on which the d-bit parallel processing can be performed can be represented using code expressions. That is, C, the product of A and B, can be represented by Equation 14 when f_n−1= . . . =f_n−d+1=0.
C:=(0, . . . ,0)
For [i=0 to n−1, i=i+d]
Let s _n−1:=α_n−1 , . . . ,s _n−d:=α_n−d
For [j=0 to d−1, j++]
C:=C⊕(b _i+j ●A)
A:=(s _n−1-j,α₀, . . . ,α_n−2)⊕(0,s _n−1-j ●f ₁ , . . . ,s _n−1-j ●f _n−d,0, . . . ,0)
Rename the coefficients of A as α₀, . . . ,α_n−1 (14)

In multiplication according to Equation 14, the process described with reference to Equation 10 are performed by d bit unit. Consequently, time complexity can be improved d times and the increase in area complexity can be minimized.

FIG. 1 illustrates a configuration of an apparatus for performing multiplication using the standard basis according to Equation 14 when n=5, f(x)=x⁵+x²+1, and d=2. The apparatus includes a multiplier storage unit 1, which stores coefficients of the multiplier A,

multiplicand storage units

21 and 22, which store coefficients of the multiplicand B, a product storage unit 3, which stores coefficients of the product result, a multiplication unit 4, and a multiplier updating unit 5.

Here, each of the

multiplicand storage units

21 and 22 includes d partial storage units. For a k^thcoefficient of the multiplicand B, when k is modulo operated by d, coefficients corresponding to the same modulo operation results are sorted out and stored into each partial storage unit. Since the shown

multiplicand storage units

21 and 22 correspond to a case of d=2, each of them includes a first partial storage unit 21, which stores only coefficients of odd terms, and a second partial storage unit 22, which stores only coefficients of even terms.

The multiplication unit 4 includes a plurality of multipliers and XOR operators. The multipliers form d sets corresponding to multiplicand coefficients stored in the

partial storage units

21 and 22. An m^thmultiplier of the respective d sets of multipliers multiplies an m^thmultiplicand coefficient output from the corresponding partial storage unit by an m^thmultiplier coefficient output from the multiplier storage unit 1.

Results of the multiplication are XORed by an m^thXOR operator and then added to pertinent coefficients in the product storage unit 3. That is, the multiplication and XOR operation are performed by d bits according to C:=C⊕(b_i+j●A) of Equation 14 and results of the multiplication and XOR operation are stored in the product storage unit 3. The multiplier updating unit 5 updates multiplier coefficients according to
A:=(s _n−1−j,α₀, . . . ,α_n−2)⊕(0,s _n−1−j ●f ₁ , . . . ,s _n−1−j ●f _n−d,0, . . . ,0)
of Equation 14 to be stored in the multiplier storage unit 1, respectively.

After 1 cycle, A becomes A=(α₃,α₄,α₀,α₁,α₂)⊕(0,0,0,α₄,0)⊕(0,0,α₃,0,0)=(α₃,α₄,α₀⊕α₃,α₁⊕α₄,α₂) according to Equation 14.

Multiplication using a dual basis according to an embodiment of the present invention will now be explained.

In the multiplication using the dual basis, a product is obtained by performing multiplication of a multiplier in a dual basis and a multiplicand in a standard basis.

Consider two elements A and B in GF(2ⁿ) represented by Equation 15.
A=α ₀+α₁α+α₂α²+ . . . +α_n−1αⁿ⁻¹=(α₀,α₁,α₂, . . . ,α_n−1),
B=b ₀ +b ₁ α+b ₂α² + . . . +b _n−1αⁿ⁻¹=(b ₀ ,b ₁ ,b ₂ , . . . ,b _n−1) (15)

Assuming that A′, a dual representation of A, is expressed as
A′=(α₀′,α₁′,α₂′, . . . ,α_n−1′),
C, the product between A and B, is expressed as
C=(c ₀ , . . . ,c _n−1),
and C′, a dual representation of C, is expressed as
C′=(c ₀ ′, . . . ,c _n−1′),
C can be represented using code expression as shown in Equation 16.
A′←A (basis conversion)
For [i=0 to n−1]
c _i′:=(b ₀●α₀′)⊕ . . . ⊕(b _n−1●α_n−1′)
t:=(f ₀●α₀′)⊕ . . . ⊕(f _n−1●α_n−1′)
A′:=A′<<1
Rename coefficients of A as α₀′, . . . ,α_n−1′
α_n−1 ′:=k
C←C′ (basis conversion) (16)

Multiplication according to Equation 16 will now be explained in detail. First, the multiplier A is converted from the standard basis into the dual basis. c_i′, i^thmultiplication result, in the dual basis is obtained by multiplying coefficients of A′ in the dual basis by coefficients of the multiplicand B and performing an XOR operation on the results of the multiplication. A coefficient of the highest power term of A′ is updated to k where k is obtained by multiplying coefficients of terms other than the term with the highest power in the defining polynomial of the finite field by coefficients of A′, performing XOR operations on results of the multiplication, and shifting the coefficients of A′ left once. After these steps are repeated n times, C′ is converted into the standard basis.

Changes of A′ within the for loop of Equation 16 will now be explained. If A′ is expressed as
A′=(α₀′,α₁′,α₂′, . . . ,α_n−1′)
when i=k, A′ may be represented by Equation 17 with f_n−1= . . . =f_n−d+1=0 when i=k+1.
A′=(α₁′,α₂′, . . . ,α_n−1′,(α₀′⊕(f ₁●α₁′)⊕ . . . ⊕(f _n−d●α_n−d′))) (17)

When i=k+d, A′ may be defined by Equation 18.
A′=(α_d′, . . . ,α_n−1′,(α₀′⊕(f ₁●α₁′)⊕ . . . ⊕(f _n−d●α_n−d′)), . . . ,(α_d−1⊕(f ₁●α_d′)⊕ . . . ⊕(f _n−d●α_n−1′))) (18)

When i=k+d, d-bit parallel processing can be performed on A′ by assumption. Further, if the integer d is small enough, it satisfies most practical cases, that is, parameters of the elliptic curve cryptosystem in SEC and ANSI X9.62 standards, thereby not violating practicability.

Multiplication using the dual basis on which the d-bit parallel processing can be performed can be represented using code expression. That is, C, the product of A and B, may be expressed by Equation 19 when f_n−1=f_n−d+1=0.
A′←A (basis conversion)
For [i=0 to n−1, i=i+d]
For [j=0 to d−1, j++]
s _j:=α_j′⊕(f ₁●α_j+1′)⊕ . . . ⊕(f _n−d●α_n−d+j′)
c _i+j′:=(b ₀●α_j′)⊕ . . . ⊕(b _n−1-j●α_n−1′)⊕(b _n−j ●s ₀)⊕ . . . ⊕(b _n−1 ●s _j−1)
A′:=A′<<d
Rename the coefficients of A′ as α₀′, . . . ,α_n−1′
For [j=0 to d−1, j++]
α_n−d+j′=s_j
C←C′ (basis conversion) (19)

In multiplication according to Equation 19, the process described with reference to Equation 16 are performed by d bit unit. Consequently, time complexity can be improved d times and the increase in area complexity can be minimized.

FIG. 2 illustrates a configuration of an apparatus for performing multiplication using a dual basis when n=5, f(x)=x⁵+x²+1, and d=2. The apparatus includes a multiplier storing and updating unit 31, which stores coefficients of a multiplier and calculates values to be updated, a multiplicand storage unit 32, and an operation unit 33. Here, a basis converting unit, which converts a_iinto α_i′ or c_i′ into c_i, is not shown.

The multiplier storing and updating unit 31 performs operations according to Equation 20 in Equation 19 to obtain coefficients in the dual basis.
A′:=A′<<d
Rename the coefficients of A′ as α₀′, . . . ,α_n−1′
For [j=0 to d−1, j++]
α_n−d+j′:=s_j (20)

The operation unit 33 performs an operation corresponding to c_i+j′:=(b₀●α_j′)⊕ . . . ⊕(b_n−1-j●α_n−1′)⊕(b_n−j●s₀)⊕ . . . ⊕(b_n−1●s_j−1) in Equation 19, wherein a′=(a′₀, . . . ,a′_n), multiplier coefficients, output from the multiplier storing and updating unit 31 and b=(b₀, . . . ,b_n), multiplicand coefficients, output from the multiplicand storage unit 32. That is, the operation unit 33 multiplies m^thmultiplicand coefficients by (m+j)^thmultiplier coefficients and performs XOR operations on results of the multiplication. The final j multiplicand coefficients are multiplied by coefficients s₀, . . . , s_j−1, which are obtained by s_j:=α_j′⊕(f₁●α_j+1′)⊕ . . . ⊕(f_n−d●α_n−d+j′), and the coefficients s₀, . . . , s_j−1are determined by a′, which is updated using Equation 20.

Accordingly, after 1 cycle, A′ becomes A′=(α₂′,α₃′,α₄′,α₀′⊕α₂′,α₁′⊕α₃′). Further, c_i′ becomes (b₀●α₀′)⊕(b₁●α₁′)⊕(b₂●α₂′)⊕(b₃●α₃′)⊕(b₄●α₄′), and c_i+1′becomes (b₀●α₁′)⊕(b₁●α₂′)⊕(b₂●α₃′)⊕(b₃●α₄′)⊕(b₄●(α₀′⊕α₂′)).

The reference numerals t₀-t₄and D₀-D₄have been used in FIG. 2 so that the operations of the operation unit 33 are more easily understood.

FIGS. 3 and 4 illustrates embodiments of basis converting means for multiplication based on the dual basis. The basis converting members shown in FIGS. 3 and 4 are the same as disclosed in Korean Patent Application No. 200-0069460 filed by the applicant of the present invention. Referring to FIGS. 3 and 4, basis conversion can be realized by simply changing the order of coefficients of the polynomial or performing XOR operations, which are relatively simple.

Table 1 shows the performance of the apparatus for performing multiplication using the standard basis.

TABLE 1

Defining			Latency
polynomial	Area complexity	Maximum delay	(cycles)

Trinomial	A: dn, X: dn + d, R: 2n + d	T_A+ (d + 1)T_X	n/d
Pentanomial	A: dn, X: dn + 3d, R: 2n + d	T_A+ (d + 3)T_X	n/d

Here, A represents a two input AND gate, X represents a two input XOR gate, R represents a register, T_Arepresents an AND gate delay, T_Xrepresents an XOR gate delay, n represents a dimension, and d represents the number of bits in parallel processing.

Table 2 shows the performance of the apparatus for performing multiplication using the dual basis.

TABLE 2

Defining			Latency
polynomial	Area complexity	Maximum delay	(cycles)

Trinomial	A: dn, X: dn, R: 2n	T_A+ (d + 1)T_X	n/d
Pentanomial	A: dn, X: dn + 2d, R: 2n	T_A+ (log₂n)T_X	n/d

Performance values of the basis converting means are excluded from Table 2.

Table 3 shows the performance of the apparatus for performing multiplication according to an embodiment of the present invention using 0.18 um process technology of Samsung Electronics Co., Ltd. with the performance values described above.

TABLE 3

	Area complexity	Maximum delay
Basis	(# of NANDs)	(nano-sec.)	Latency (Cycles)

Standard d = 8	13129.7	3.707	35
Dual d = 8	13102.3	2.793	35
Standard d = 4	8169.5	2.427	71
Dual d = 4	8176.8	2.793	71
Standard d = 2	5689.3	1.147	142
Dual d = 2	5714.0	2.793	142

Here, the apparatus for performing multiplication based on the dual basis includes the basis converting means.

According to Table 3, when computational speed doubled, area complexity increased approximately 1.43 to 1.61 times. Therefore, the area complexity does not rise rapidly.

As described above, since the apparatus according to an embodiment of the present invention performs the serial multiplication allowing the d-bit parallel processing, the apparatus is faster for arithmetic operation than the conventional serial multiplier and can minimize the increase of area complexity. Furthermore, an expected maximum delay of 100 MHz is within one clock cycle. Accordingly, the apparatus can be effectively applied to terminals having a low clock speed.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined by the following claims.

Claims

1. A method of performing multiplication through d-bit parallel processing using a serial multiplier by obtaining C=(c₀, . . . , c_n−1) of a product of two elements A and B of a finite field GF(2ⁿ) when a defining polynomial f(x) of degree n in the finite field GF(2ⁿ) is defined by

f(x)=x ⁿ +h(x)=x ⁿ+(f _n−1 x ⁿ⁻¹ + . . . +f ₁ x+f ₀), f _i∈{0,1} ,

where f_n−1= . . . =f_n−d+1=0, d≧2, d is an integer, α is a root of the defining polynomial, A and B of the finite field are expressed as

A=α ₀+α₁α+α₂α²+ . . . +α_n−1αⁿ⁻¹=(α₀,α₁,α₂, . . . ,α_n−1),

B=b ₀ +b ₁ α+b ₂α² + . . . +b _n−1αⁿ⁻¹=(b ₀ ,b ₁ ,b ₂ , . . . ,b _n−1)

with respect to the root α, and C of the product of A and B can be rewritten as C=A×B mod f(α), the method comprising:

permuting the last d coefficients (a_n−1, . . . , a_n−d) of a multiplier, which is A, with predetermined variables (s_n−1, . . . , s_n−d);

operating C:=C⊕(b_i+j●A) for (i+j)^thcoefficient of a multiplicand, which is B, to update coefficients of C, where i and j are integers, and

A:=(s _n−1−j,α₀, . . . ,α_n−2)⊕(0,s _n−1−j ●f ₁ , . . . ,s _n−1−j ●f _n−d,0, . . . ,0)

repeatedly for j=0 to (d−1) to update coefficients of A, where ⊕ represents an XOR operation and ● represents an AND operation; and

repeatedly performing the permuting and operating by increasing i from 0 to (n−1) by d to obtain a final product C.

2. An apparatus for performing multiplication through d-bit parallel processing using a serial multiplier by obtaining C=(c₀, . . . , c_n−1), of a product of two elements A and B of a finite field GF(2ⁿ) when a defining polynomial f(x) of degree n in GF(2ⁿ) is defined by

f(x)=x ⁿ +h(x)=x ⁿ+(f _n−1 x ⁿ⁻¹ + . . . +f ₁ x+f ₀), f _i∈{0,1},

where f_n−1= . . . =f_n−d+1=0, d≧2, d is an integer, α is a root of the defining polynomial, the two elements A and B of the finite field are expressed as

with respect to the root α, and C of the product of A and B can be rewritten as C=A×B mod f(α), the apparatus comprising:

a multiplier storage unit, which stores coefficients of a multiplier, which is A;

a multiplicand storage unit, which stores coefficients of a multiplicand, which is B;

a product storage unit, which stores C of the product of A and B;

a multiplication unit, which performs operations of the Equation C:=C⊕(b_i+j●A), repeatedly, for j=0 to (d−1), where i and j are integers, ⊕ represents an XOR operation, and ● represents an AND operation, repeatedly performs the above steps by increasing the variable i from 0 to (n−1) by d to obtain updated coefficients of C, and outputs the updated coefficients of C to the product storage unit; and

a multiplier updating unit, which performs operations of the Equation A:=(s_n−1−j,α₀, . . . ,α_n−2)⊕(0,s_n−1−j●f₁, . . . ,s_n−1−j●f_n−d,0, . . . ,0) to update the coefficients of A, where i and j are integers, ⊕ represents an XOR operation, and ● represents an AND operation, and outputs the updated coefficients of A to the multiplier storage unit.

3. The apparatus of claim 2, wherein the multiplicand storage unit includes d partial storage unit, and each partial storage unit stores coefficients having the same modulo operation results when for a k_thcoefficient of the multiplicand, the value k is modulo operated by d.

4. The apparatus of claim 3, wherein the multiplication unit includes:

d sets of multipliers, which correspond to the partial storage unit and respectively multiply multiplicand coefficients output from the partial storage unit by multiplier coefficients output from the multiplier storage unit; and

a plurality of logic operation members, which perform a first XOR operation on outputs from an m^thmultiplier of each set of the multipliers, perform a second XOR operation on a result of the first XOR operation with a value stored in an m^thlocation of the product storage unit, and output the result of the second XOR operation to the product storage unit.

5. A method of performing multiplication in a serial multiplier using a dual basis, where a product is obtained by performing multiplication with a multiplier in a dual basis and a multiplicand in a standard basis by obtaining C=(c₀, . . . , c_n−1), of the product of two elements A and B of a finite field GF(2ⁿ) when a defining polynomial f(x) of degree n in GF(2ⁿ) is defined as

f(x)=x ⁿ +h(x)=x ⁿ+(f _n−1 x ⁿ⁻¹ + . . . +f ₁ x+f ₀),f _i∈{0,1},

where f_n−1= . . . =f_n−d+1=0, d≧2, d is an integer, α is a root of the defining polynomial, A and B of the finite field have a standard representation with respect to the root α as shown in

A=α ₀+α₁α+α₂α²+ . . . +α_n−1αⁿ⁻¹=(α₀,α₁,α₂, . . . ,α_n−1′),

B=b ₀ +b ₁ α+b ₂α² + . . . +b _n−1αⁿ⁻¹=(b ₀ ,b ₁ ,b ₂ , . . . ,b _n−1),

A′, a dual representation of A, is expressed as A′=(α₀′,α₁′,α₂′, . . . ,α_n−1′) and C can be rewritten as C=A×B mod f(α), the method comprising:

converting A into A′;

operating of the following formulae

s _j:=α_j′⊕(f ₁●α_j+1′)⊕ . . . ⊕(f _n−d●α_n−d+j′)

c_i+j′:=(b₀●α_j′)⊕ . . . ⊕(b_n−1−j●α_n−1′)⊕(b_n−j●s₀)⊕ . . . ⊕(b_n−1●s_j−1) repeatedly for i, j=0 to d−1 to update coefficients of C′, which is a dual representation of C, where i and j are integers, c_i+j′ is a dual representation of c_i+j′;

shifting A′ left d times to update A′;

updating the last d coefficients of A′ with s_j;

repeatedly performing the operating, shifting, and updating by increasing the variable i from 0 to (n−1) by d to obtain updated coefficients of C′; and

performing basis conversion on the updated C′ to obtain a final product C.

6. An apparatus for performing multiplication using a dual basis, where a product is obtained by performing multiplications of a multiplier in a dual basis and a multiplicand in a standard basis obtaining C=(c₀, . . . , c_n−1), of a product of two elements A and B of a finite field GF(2ⁿ) when a defining polynomial f(x) of degree n in GF(2ⁿ) is defined as

B=b ₀+b₁α+b₂α² +. . . +b _n−1αⁿ⁻¹=(b ₀ ,b ₁ ,b ₂ , . . . ,b _n−1),

A′, a dual representation of A, is expressed as A′=(α₀′,α₁′,α₂′, . . . ,α_n−1′), and C of A and B is rewritten as C = A×B mod f(α), the apparatus comprising:

a basis converting unit, which converts the standard representation into a dual representation, or converts the dual representation into the standard representation;

a multiplicand storage unit, which stores coefficients of a multiplicand B;

a multiplier storage unit, which stores coefficients of A′ obtained by converting basis of a multiplier A by means of the basis converting unit;

a multiplier updating unit, which updates the coefficients of A′ according to a predetermined Equation and outputs the updated coefficients to the multiplier storage unit; and

an operation unit, which includes a plurality of multipliers multiplying each m^thcoefficient from the multiplicand storage unit by each (m+j)^thcoefficient from the multiplier storage unit where j varies from 0 to (d−1) and multiply the last j coefficients from the multiplicand storage unit by a part of outputs from the multiplier updating unit, and a plurality of logic operation members fort performing XOR operations on only outputs containing the (m+j)^thcoefficients from the plurality of multipliers and output the last d c_i's,

wherein after C′ is obtained by the operation unit module, and the basis converting unit converts basis of C′ to obtain C.

7. The apparatus of claim 6, wherein the operation unit performs operations of the Equation

s _j:=α_j′⊕(f ₁●α_j+1′)⊕ . . . ⊕(f _n−d●α_n−d+j′)

c _i+j′:=(b ₀●α_j′)⊕ . . . ⊕(b _n−1−j●α_n−1′)⊕(b _n−j ●s ₀)⊕ . . . ⊕(b _n−1 ●s _j−1)

repeatedly for j=0 to (d−1), where i and j are integers, c_i+j′ is a dual representation of c_i+j, using the plurality of multipliers and logic operation members, outputs d coefficients of C′, which is a dual representation of C, and obtains c_i+j′, which is a dual representation of an (i+j)^thcoefficient of C, by increasing the variable i from 0 to (n−1) by d.

8. The apparatus of claim 6, wherein the multiplier updating unit:

shifts A′ stored in the multiplier storage unit, left d times to update A′; and performs operations of the Equation

s _j:=α_j′⊕(f ₁●α_j+1′)⊕ . . . ⊕(f _n−d●α_n−d+j′)

α_n−d+j′:=s_jrepeatedly for j=0 to (d−1) to update the last d coefficients of A′.